From 8967abe38959180c8a8f2bbd5f8e24209cc23ebd Mon Sep 17 00:00:00 2001 From: jonahgabriel Date: Sat, 6 Jun 2026 17:20:24 -0400 Subject: [PATCH 1/2] chore(OMN-12751): baseline omnibase_infra freestanding guard --- allowlists/omnibase_infra.yaml | 194 +++++++++++++++++++++++++++++++++ 1 file changed, 194 insertions(+) diff --git a/allowlists/omnibase_infra.yaml b/allowlists/omnibase_infra.yaml index a129ee72942..b6b2a279249 100644 --- a/allowlists/omnibase_infra.yaml +++ b/allowlists/omnibase_infra.yaml @@ -109,3 +109,197 @@ allowlisted_handlers: violations: - missing_handler_routing ticket: '# migration pending' + - path: src/omnibase_infra/adapters/github/adapter_github_client.py + violations: + - freestanding_raw_http + ticket: OMN-12751 + - path: src/omnibase_infra/backends/backend_probe.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/cli/artifact_reconcile.py + violations: + - freestanding_kafka_client + ticket: OMN-12751 + - path: src/omnibase_infra/cli/cli_env.py + violations: + - freestanding_hardcoded_private_ip + ticket: OMN-12751 + - path: src/omnibase_infra/cli/cli_kafka.py + violations: + - freestanding_kafka_client + - freestanding_hardcoded_private_ip + ticket: OMN-12751 + - path: src/omnibase_infra/cli/commands.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/cli/infra_test/run_suite.py + violations: + - freestanding_db_connection + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/cli/infra_test/verify.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/cli/service_demo_reset.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/dlq/plugin_dlq.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/dlq/service_dlq_tracking.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/enums/generated/enum_artifact_topic.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/enums/generated/enum_omnibase_infra_topic.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/enums/generated/enum_omnimarket_topic.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/enums/generated/enum_platform_topic.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/event_bus/event_bus_kafka.py + violations: + - freestanding_raw_http + - freestanding_kafka_client + ticket: OMN-12751 + - path: src/omnibase_infra/event_bus/topic_constants.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/event_bus/topic_violation_alerter.py + violations: + - freestanding_raw_http + ticket: OMN-12751 + - path: src/omnibase_infra/handlers/handler_db.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/handlers/handler_gmail_api.py + violations: + - freestanding_raw_http + ticket: OMN-12751 + - path: src/omnibase_infra/handlers/handler_linear_db_error_reporter.py + violations: + - freestanding_raw_http + ticket: OMN-12751 + - path: src/omnibase_infra/handlers/handler_slack_webhook.py + violations: + - freestanding_raw_http + ticket: OMN-12751 + - path: src/omnibase_infra/handlers/registration_storage/handler_registration_storage_postgres.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/idempotency/store_postgres.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/mixins/mixin_llm_http_transport.py + violations: + - freestanding_raw_http + - freestanding_hardcoded_private_ip + ticket: OMN-12751 + - path: src/omnibase_infra/models/discovery/model_introspection_config.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/models/projection/model_topic_projection.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/models/validation_ledger/model_validation_ledger_entry.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/nodes/node_dlq_replay_effect/engine_dlq_replay.py + violations: + - freestanding_kafka_client + ticket: OMN-12751 + - path: src/omnibase_infra/nodes/node_registration_orchestrator/plugin.py + violations: + - freestanding_kafka_client + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/probes/capability_probe.py + violations: + - freestanding_raw_http + ticket: OMN-12751 + - path: src/omnibase_infra/projectors/snapshot_publisher_registration.py + violations: + - freestanding_kafka_client + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/auto_wiring/handler_wiring.py + violations: + - freestanding_kafka_client + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/emit_daemon/topics.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/providers/provider_http_client.py + violations: + - freestanding_raw_http + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/providers/provider_kafka_producer.py + violations: + - freestanding_kafka_client + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/providers/provider_postgres_pool.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/request_response_wiring.py + violations: + - freestanding_kafka_client + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/runtime_scheduler.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/service_kernel.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/service_pattern_b_broker.py + violations: + - freestanding_kafka_client + ticket: OMN-12751 + - path: src/omnibase_infra/runtime/util_schema_fingerprint.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/services/service_llm_endpoint_health.py + violations: + - freestanding_raw_http + ticket: OMN-12751 + - path: src/omnibase_infra/services/session/consumer.py + violations: + - freestanding_kafka_client + ticket: OMN-12751 + - path: src/omnibase_infra/services/session/store.py + violations: + - freestanding_db_connection + ticket: OMN-12751 + - path: src/omnibase_infra/topics/platform_topic_suffixes.py + violations: + - freestanding_hardcoded_topic + ticket: OMN-12751 + - path: src/omnibase_infra/tui/consumers/consumer_status.py + violations: + - freestanding_kafka_client + ticket: OMN-12751 From 1e90bd9cbd7114660cec2a116cdad738d6ea77d9 Mon Sep 17 00:00:00 2001 From: jonahgabriel Date: Sat, 6 Jun 2026 17:23:13 -0400 Subject: [PATCH 2/2] docs(OMN-12751): add guard baseline receipts --- contracts/OMN-12751.yaml | 37 +++++++++++++++++++ .../command.yaml | 21 +++++++++++ .../command.yaml | 21 +++++++++++ 3 files changed, 79 insertions(+) create mode 100644 contracts/OMN-12751.yaml create mode 100644 drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml create mode 100644 drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml diff --git a/contracts/OMN-12751.yaml b/contracts/OMN-12751.yaml new file mode 100644 index 00000000000..b2ee872d753 --- /dev/null +++ b/contracts/OMN-12751.yaml @@ -0,0 +1,37 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-12751" +title: "Pay down omnibase_infra freestanding imperative guard baseline" +summary: >- + Central OCC evidence for baselining the existing omnibase_infra freestanding imperative guard findings + so the OMN-12245 release backmerge can validate version-only release metadata without masking new findings. +is_seam_ticket: false +interface_change: false +interfaces_touched: [] +emergency_bypass: + enabled: false + justification: "" + follow_up_ticket_id: "" +dod_evidence: + - id: "dod-occ-allowlist-main-pr-2240" + description: "onex_change_control PR #2240 carries the main OCC allowlist baseline for omnibase_infra + live freestanding imperative guard findings." + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml + && grep -q '^pr_number: 2240$' drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml + && grep -q '8967abe38959180c8a8f2bbd5f8e24209cc23ebd' drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml + - id: "dod-occ-allowlist-backmerge-pr-2239" + description: "onex_change_control PR #2239 carries the dev backmerge of the OMN-12751 omnibase_infra + freestanding imperative guard baseline." + source: "manual" + status: "verified" + checks: + - check_type: "command" + check_value: >- + grep -q '^status: PASS$' drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml + && grep -q '^pr_number: 2239$' drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml + && grep -q '1150786c7f83cbf93b62ab1145d88cd15ba7cfd7' drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml diff --git a/drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml b/drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml new file mode 100644 index 00000000000..104fcca8883 --- /dev/null +++ b/drift/dod_receipts/OMN-12751/dod-occ-allowlist-backmerge-pr-2239/command.yaml @@ -0,0 +1,21 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-12751" +evidence_item_id: "dod-occ-allowlist-backmerge-pr-2239" +check_type: "command" +check_value: "gh pr view 2239 --repo OmniNode-ai/onex_change_control --json number,state,baseRefName,headRefName,headRefOid,title,url" +contract_sha256: "sha256:4d9c359c8fcc6982fb07485e3e8049a51b445dd21de877e27dd495aa0514533d" +status: PASS +run_timestamp: "2026-06-06T21:27:00Z" +commit_sha: "1150786c7f83cbf93b62ab1145d88cd15ba7cfd7" +runner: "codex-cli" +verifier: "main-release-version-backmerge-sweep" +probe_command: "gh pr view 2239 --repo OmniNode-ai/onex_change_control --json number,state,baseRefName,headRefName,headRefOid,title,url" +probe_stdout: | + {"baseRefName":"dev","headRefName":"hotfix/omn-12751-infra-freestanding-baseline-dev","headRefOid":"1150786c7f83cbf93b62ab1145d88cd15ba7cfd7","number":2239,"state":"OPEN","title":"chore(OMN-12751): backmerge omnibase_infra freestanding guard baseline","url":"https://github.com/OmniNode-ai/onex_change_control/pull/2239"} +actual_output: "PASS: onex_change_control PR #2239 carries the OMN-12751 omnibase_infra freestanding imperative + guard allowlist baseline backmerge on dev." +exit_code: 0 +pr_number: 2239 +branch: "hotfix/omn-12751-infra-freestanding-baseline-dev" +working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-12751-backmerge/onex_change_control" diff --git a/drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml b/drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml new file mode 100644 index 00000000000..4c289a411d7 --- /dev/null +++ b/drift/dod_receipts/OMN-12751/dod-occ-allowlist-main-pr-2240/command.yaml @@ -0,0 +1,21 @@ +--- +schema_version: "1.0.0" +ticket_id: "OMN-12751" +evidence_item_id: "dod-occ-allowlist-main-pr-2240" +check_type: "command" +check_value: "gh pr view 2240 --repo OmniNode-ai/onex_change_control --json number,state,baseRefName,headRefName,headRefOid,title,url" +contract_sha256: "sha256:4d9c359c8fcc6982fb07485e3e8049a51b445dd21de877e27dd495aa0514533d" +status: PASS +run_timestamp: "2026-06-06T21:27:00Z" +commit_sha: "8967abe38959180c8a8f2bbd5f8e24209cc23ebd" +runner: "codex-cli" +verifier: "main-release-version-backmerge-sweep" +probe_command: "gh pr view 2240 --repo OmniNode-ai/onex_change_control --json number,state,baseRefName,headRefName,headRefOid,title,url" +probe_stdout: | + {"baseRefName":"main","headRefName":"hotfix/omn-12751-infra-freestanding-baseline","headRefOid":"8967abe38959180c8a8f2bbd5f8e24209cc23ebd","number":2240,"state":"OPEN","title":"chore(OMN-12751): baseline omnibase_infra freestanding guard","url":"https://github.com/OmniNode-ai/onex_change_control/pull/2240"} +actual_output: "PASS: onex_change_control PR #2240 carries the OMN-12751 omnibase_infra freestanding imperative + guard allowlist baseline on main." +exit_code: 0 +pr_number: 2240 +branch: "hotfix/omn-12751-infra-freestanding-baseline" +working_dir: "/Users/jonah/Code/omni_home/omni_worktrees/OMN-12751/onex_change_control"